DOJ, FBI and CrowdStrike Disrupt Sality Botnet Across United States, Bulgaria, Hungary, Romania

Sality botnet disrupted

The U.S. Department of Justice confirmed a coordinated international takedown of the Sality botnet, a peer-to-peer malware network that has plagued victims worldwide since 2003.

The operation spanned the United States, Bulgaria, Hungary, and Romania, and relied on cooperation between the DOJ, FBI, the Department of Defense’s Defense Criminal Investigative Service (DCIS), and private-sector cybersecurity firms CrowdStrike and the Shadowserver Foundation.

First Assistant United States Attorney Bill Essayli said the takedown demonstrates that "the public and private sectors can be a powerful force for good" against botnets and malware.

FBI Los Angeles Assistant Director in Charge Patrick Grandy added that collaboration strengthens the Bureau’s capacity to neutralize threats like Sality, while DCIS Special Agent in Charge Kenneth DeChellis emphasized the operation’s importance to protecting the Department of Defense Information Network.

The disruption unfolded this week when CrowdStrike’s Counter Adversary Operations team executed a peer-to-peer sinkhole, rerouting botnet traffic away from criminal control.

Reporting for this sectionCyberSecurityNews

How the sinkhole worked

Recorded Future News from Recorded Future said Sality was disrupted Monday in an operation involving authorities in the U.S., Bulgaria, Hungary and Romania, alongside CrowdStrike and the nonprofit Shadowserver Foundation. It described CrowdStrike researcher Tillmann Werner telling Reuters that the disruption required extensive reverse-engineering and was the most complex botnet takeover the company had ever conducted. The Recorded Future report said CrowdStrike severed the connection between more than 15,000 infected computers by targeting the mechanism Sality used to maintain its decentralized network.

It explained that each infected machine keeps a list of publicly reachable systems known as “super peers,” and that CrowdStrike injected false information into those “super peer” lists so infected computers lost contact with other members of the botnet. David Watson, a director at Shadowserver, told Reuters that Sality was “quite old-school” but remained dangerous because compromised machines could still provide attackers with a foothold inside organizations.

Reporting for this sectionThe Record from Recorded Future News

Crypto theft and next risks

Across the reporting, Sality’s peer-to-peer design is tied to credential theft and cryptocurrency theft, with CrowdStrike describing EggJagger as a “clipjacking tool” that monitors a device's clipboard for cryptocurrency wallet addresses.

The U.S. Department of Justice announcement, as relayed in multiple outlets, framed the action as a disruption rather than a total elimination, with the Menafn account saying the takedown interfered with the malware's ability to coordinate with infected machines.

CrowdStrike reported that over the eight years preceding the disruption, the operators behind Sality used EggJagger to steal at least 12.1 million rubles, about $150,000, and that the value of the “never-spent” digital assets peaked at about $1.5 million in January 2025.

In the same accounts, CrowdStrike said the criminals “lost the ability to communicate with infected machines” as a result of law enforcement efforts to dismantle the network.

The Menafn report also said Sality’s peer-to-peer botnet checked whether systems were online every 40 minutes, and that investigators moved against Sality-linked domains in the U.S. and additional domains in Europe.

Reporting for this sectionMenafn